next-auth@4.24.15

anomalyco/opentuinext-auth@4.24.15Jul 20, 2026by gustavovalverde

AI Summary

Security patch release for the NextAuth 4.x line addressing authentication validation, cookie handling, and compatibility issues.

Key Highlights

`getToken()` no longer throws when the Authorization header is malformed
OAuth state, nonce, and PKCE cookies bound to the creating provider
Email addresses are Unicode-normalized (NFKC) to prevent homoglyph bypass
`NEXTAUTH_URL` now takes precedence over auto-detected forwarded host
CommonJS compatibility restored by pinning uuid to ^11.1.1

New Features

OAuth cookie provider binding
Email address Unicode normalization

Full Release Notes

Security patch release for the 4.x line.

- `getToken()` now returns `null` instead of throwing when the `Authorization` header contains a malformed Bearer value.
- OAuth `state`, `nonce`, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
- Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph `@` bypass.
- An explicitly configured `NEXTAUTH_URL` now takes precedence over the auto-detected forwarded host in trusted-host mode.
- Restores CommonJS compatibility by pinning `uuid` to `^11.1.1`; the 14.x line is ESM-only and broke `require()` on Node versions below 20.19.